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FOREWORD 


The  research  documented  in  this  volume  was  conducted  under  Ballistic 
Missile  Advanced  Technology  Center  contract  number  DASG60-76-C-0087, 
entitled  "Distributed  Data  Processing  Technology."  This  work  was 
performed  by  Honeywell  Systems  and  Research  Center,  Minneapolis, 
Minnesota  under  the  direction  of  Mr.  C.  R.  Vick,  Director,  Data  Pro- 
cessing Directorate,  Ballistic  Missile  Defense  Advanced  Technology 
Center.  Mr.  J.  ScaU  was  the  BMDATC  project  engineer  for  this 
contract;  Ms.  B.C.  Stewart  was  the  Honeywell/GRC  program  manager. 


This  report  covers  work  from  October  1976  to  October  1977.  Work 
on  this  task  was  performed  by  W.  E.  Boebert  of  the  Honeywell  Systems 
and  Research  Center  and  W.  R.  Franta  of  the  University  of  Minnesota. 
These  individuals  also  wrote  a preliminary  version  of  this  report.  The 
final  version  was  written  by  W.  E.  Boebert.  The  bibliography  was 
compiled  by  D.  L.  Hutchinson  of  the  University  of  Minnesota. 


This  report  presents  the  results  of  work  in  the  area  of  payoffs  (non- 
functional requirements)  which  derive  from  the  use  of  distributed  data 
processing  in  the  data  processing  subsystems  of  BMD  systems.  The 
report  states  the  objective  of  quantifiable  or  figure -of-merit  payoffs, 

shows  why  that  objective  is  not  attainable  at  this  time,  and  presents  two 

» 

approaches  to  achieve  the  objective.  It  also  presents  a preliminary 
description  of  the  payoffs  of  distributed  data  processing  in  the  form  of 
a comparison  with  centralized  data  processing.  All  the  results  are 
presented  in  the  context  of  an  existing  Systems  Engineering  framework. 


This  document  is  Volume  II  of  the  final  report.  Other  volumes  of  the 
report  are  the  following:* 


Volume  I 

Management  Summary  6^1 

Volume  III 

DDP  Rationale:  The  Technology  Point  of 
View 

Volume  IV 

Application  of  DDP  Technology  to  BMD: 
Architectures  and  Algorithms 

Volume  V 

Application  of  DDP  Technology  to  BMD: 
DDP  Subsystem  Design  Requirements 

Volume  VI 

Application  of  DDP  Technology  to  BMD: 
Impact  on  Current  DP  Subsystem  Design 
and  Development  Technologies 

Volume  VII 

Application  of  DDP  Technology  to  BMD: 
Experiments 

Volume  VIII 

Application  of  DDP  Technology  to  BM'^: 
Research  Performance  Measurement 

Volume  IX 

DDP  Rationale:  The  Program  Experience 
Point  of  View 

* Volumes  V,  VI,  the  appendix  to  Volume  VII,  and  a section  of 
Volume  VIII  were  prepared  by  General  Research  Corporation. 
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SECTION  1 


BACKGROUND  AND  OVERVIEW 


OVERVIEW 


This  volume  is  concerned  with  three  distinct  major  research  areas.  The 
first  is  the  need,  in  developing  an  analytic  DDP  design  technology,  for  a 
complete  Systems  Engineering  framework  (to  replace  the  inadequate  water- 
fall chart)  as  a research  context  and  model  of  the  BMD  system  and  DP 
subsystem  life  cycle;  this  research  is  presented  in  Section  2.*  The  second 
area  is  the  derivation  of  a payoff  quantification  methodology  (within  the 
system  context  established  in  Section  2)  as  an  early  part  of  the  DDP  design 
theory;  this  research  is  presented  in  Sections  3 and  5.  The  third  research 
area  is  the  actual  comparison  of  payoffs  of  centralized  vs.  distributed  data 
processing  (again  within  the  systems  context  of  Section  2);  these  results 
are  discussed  in  Section  4.  Key  results  are  summarized  in  Section  6,  and 
critical  research  issues  and  recommendations  are  presented  in  Section  7. 

OBJECTIVES 

Our  effort  throughout  this  task  has  been  directed  ^oward  establishing  the 
Ballistic  Missile  Defense  (BMD)  payoffs**  which  derive  from  the  use  of 
distributed  data  processing  (DDP).  In  particular,  we  wished  to  compare 


*In  addition,  a large  bibliography  of  related  research  material  has  been 
provided  as  reference  for  interested  research  personnel. 

**In  this  document  "payoffs"  and  "nonfunctional  requirements"  are 
synonymous. 


the  payoffs  derived  from  DDP  with  those  which  are  obtainable  from  the  other 
broad  technological  alternative  for  data  processing  subsystems- -centralized 
data  processing  (CDP). 
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APPROACH 

We  initially  adopted  a straightforward  and,  in  retrospect,  somewhat  naive 
approach:  define  a list  of  relevant  payoffs,  devise  metrics  and  formulae  by 
which  these  payoffs  could  be  measured,  and  compute  and  compare  the 
respective  measures  for  DDP  and  CDP. 

We  then  reviewed  the  various  discussions  of  BMD  payoffs  which  we  obtained 
during  the  course  of  the  contract.  These  discussions  came  from  a variety 
of  sources  [312]  and  all  contained  a great  many  appeals  to  the  intuition: 

• Terms  such  as  "growth,"  "reconfigurability,"  and  "BMD  effective- 
ness" were  used  interchangeably  to  describe  the  benefits  that  poten- 
tial BMD  systems  may  derive  from  a given  technology,  desirable 
objectives  of  a BMD  system  design  activity,  attributes  of  a specific 
BMD  subsystem,  and  criteria  for  evaluating  technology  or  imple- 
mentation alternatives. 

• The  presentation  of  BMD  payoffs  as  a "flat"  or  unstructured  list 
ignored  the  clear  existence  of  interrelationships,  orderings,  and 
dependencies;  "growth"  is  not  the  same  thing  as  "fault  isolation,  " 
either  in  degree  or  kind. 
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A further  attribute  of  BMD  payoffs  is  obscured  by  compiling  them  into  a 
simple  list:  certain  payoffs  exist  or  are  manifest  only  during  specific 
phases  of  BMD  system  life  cycle,  while  others  describe  the  worth  of  the 
system  throughout  its  existence. 

We  noted  these  problems  and  began  a wide-ranging  and  systematic  review  of 
the  literature,  still  with  the  goal  of  seeking  methods  for  devising  formulae 
for  quantitative  assessment  of  BMD  payoffs.  In  the  course  of  this  review, 
we  found  a large  area  of  relevant  work  in  the  general  field  of  Systems  Engin- 
eering [258],  especially  in  the  publications  of  Hall  [124],  Hill  [131],  and 
Warfield  [131,320].  An  examination  of  this  work  yielded  the  fundamental 
insight  that  a pursuit  of  formulae  at  this  stage  is  wholly  premature;  it  is  not 
possible  to  express  relations  between  variables  in  mathematical  terms  until 
a list  of  variables  has  been  defined  and  the  simple  presence  or  absence  of 
relations  between  them  has  been  determined.  This  preliminary  step,  defining 
variables  and  determining  meaningful  intervariable  relationships,  is  a non- 
trivial one  in  our  case  where  we  are  attempting  to  define  a relationship  be- 
tween a partially  developed  technology  of  great  flexibility  (DDP)  and  an 
extremely  large  and  complex  problem  (BMD). 

We  accordingly  revised  our  approach  while  still  maintaining  the  goal  of 
comparing  CDP  and  DDP  within  the  context  of  BMD  payoffs.  This  revised 
approach,  and  the  results  to  be  presented  in  the  subsequent  sections, 
involved  the  following  steps; 

1,  Definition  of  BMD  Payoffs--We  sharpened  the  definition  of  the 
term  "BMD  payoff"  and  placed  our  defined  concept  in  the  context 
of  existing  Systems  Engineering  methodologies. 
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2.  Payoff  Derivation  Methodology- -We  developed  an  overview  of 
methodology  for  the  derivation  of  BMD  payoffs  and  derived  a 
structured  set  of  payoffs  using  the  methodology. 

3.  Comparison  of  CDP  and  DDP--We  expanded  the  Hall-Hill- 
Warfieid  notation  and  used  it  to  present  a non -quantified  compari- 
son of  CDP  and  DDP  in  terms  of  payoffs. 

4.  Approaches  to  Quantifiable  Payoffs--We  present  two  approaches 
which  could  result  in  a set  of  quantifiable  BMD  payoffs. 

5.  Further  Research--We  evaluated  the  results  of  this  phase  and  con- 
sidered the  direction  and  specific  nature  of  desirable  further 
research  in  the  area  of  BMD  payoffs. 

Many  of  the  results,  methods,  and  notations  which  are  presented  in  the 
subsequent  sections  will  appear  straightforward  to  the  point  of  being  obvious. 
This  is  a consequence  both  of  the  scope  of  this  task,  which  did  not  permit 
the  development  or  exercise  of  tools  to  support  elaborate  examples,  and 
the  basic  nature  of  Systems  Engineering.  This  discipline  imposes  order 
and  structure  upon  the  solution  process  for  complex  problems.  The  order 
and  structure  which  it  imposes  is  natural  and  appropriate  and,  therefore, 
obvious  in  retrospect.  It  is  by  no  means  obvious  during  the  early  stages 
of  a task  when  disjoint  and  partially-defined  elements  of  problem  and 
solution  are  surfacing  in  random  order. 


SECTION  2 


DEFINITION  OF  HMD  PAYOFFS 

THE  SYSTEMS  ENGINEERING  CONTEXT 

Morphology 

We  begin  with  the  general  morphology  of  Systems  Engineering  which  was 
first  presented  by  Hall  [124]  and  refined  by  Hill  and  Warfield  [131J. 

s 

This  morphology  is  shown  in  Figure  1 [124],  and  the  relationship  between 
its  terms  and  those  of  other  frameworks,  as  presented  by  Sage  [ 258], 
is  given  in  Table  1 [258], 

As  can  be  seen  in  Figure  1,  the  Hall  morphology  gives  a three-dimensional 
framework  for  Systems  Engineering  with  the  axes  depicting  the  time,  logic, 
and  knowledge  dimensions  of  the  discipline.  The  time  dimension  is  seg- 
mented by  the  major  decision  milestones.  The  segments  between  mile- 
stones are  referred  to  as  phases.  The  logic  dimension  describes  the 
steps  of  the  problem-solving  procedure.  The  use  of  two  separate  dimen- 
sions for  these  two  aspects  of  Systems  Engineering  results  in  a general 
structure  in  which  any  step  (e.g. , Systems  Analysis)  may  be  discussed 
in  the  context  of  any  phase  (e.g. , Project  Planning).  This  point  will  be 
discussed  below  in  greater  detail.  The  last  dimension  of  the  Hall  morphol- 
ogy, the  knowledge  dimension,  is  organized  somewhat  arbitrarily  into 
disciplines  ranked  according  to  the  degree  in  which  they  embody  formal 
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(Adapted  from  [124]) 


TABLE  1.  COMPARISON  OF  FRAMEWORKS  FOR  SYSTEMS  ENGINEERING 
(FROM  [258]) 


Action  implenienta-  for  action  lion  allocation  recom- 

tion  mendations 


or  mathematical  techniques.  Thus,  any  point  within  Hall's  morphological 
box  represents  the  application  of  a discipline  (knowledge,  or  capability) 
to  a step  (an  aspect  of  problem  solving)  within  a phase  (some  period  in  the 
system  life  cycle).  This  is  shown  in  Figure  2. 

The  knowledge  dimension  of  the  Hall  matrix,  as  presented  in  literature, 
reflects  an  initial  preoccupation  of  Systems  Engineering  with  urban  and 
societal  problems  and  therefore  must  be  modified  for  BMD  applications. 
Such  an  exercise,  although  potentially  valuable,  is  outside  the  scope  of 
this  task.  Instead,  we  turn  our  attentions  to  the  other  two  dimensions  of 
the  morphology:  the  time  and  logic  axes. 

Time 


The  time  axis  is  broken  down  into  seven  phases.  A program  is  defined 
and  selected  in  the  Program  Planning  phase  of  Systems  Engineering.  The 
specific  projects  to  be  carried  out  are  identified  in  the  Project  Planning 
phase.  In  System  Development,  projects  necessary  to  develop  the  system 
are  implemented  and  production  plans  are  made.  System  elements  as 
well  as  the  total  system  are  produced,  and  plans  are  made  for  installation 
of  systems  in  the  Production  phase.  The  system  is  installed  and  plans 
are  completed  for  system  operation  in  the  Distributory  phase.  The  system 
is  put  to  useful  work  during  the  Operations  phase.  In  the  Retirement  phase, 
the  system  is  withdrawn  from  service. 


Logic 


The  logic  axis,  which  represents  the  various  elements  of  the  problem- 
solving process,  is  broken  down  into  seven  steps.  The  Problem  Definition 
step  is  aimed  at  determining  how  the  particular  problem  under  consideration 
came  to  be  a problem.  The  purpose  of  Value  System  Design  is  to  postulate 
and  clarify  objectives  to  resolve  problems  identified  in  the  previous  step. 
Conceptualization  of  potential  candidate  policies,  activities,  controls,  or 
whole  systems  which  might  allow  attainment  of  objectives  is  the  object  of 
Systems  Synthesis.  The  purpose  of  Systems  Analysis  (and  modeling)  is  to 
develop  insight  into  the  interrelationships,  behavior,  and  characteristics 
of  proposed  policies,  activities,  controls,  or  systems  in  terms  of  objective 
attainment  and  problem  resolution  and  need  satisfaction.  In  the  Optimiza- 
tion or  ranking  of  alternatives  step,  particular  policy  parameters  and 
coefficients  are  selected  such  that  each  proposed  policy  is  the  best  policy 
possible  in  terms  of  ultimate  satisfaction  of  the  value  system.  Decision 
Making  is  aimed  at  selecting  one  or  more  policies  or  systems  worthy  of 
further  consideration.  In  Planning  for  Action,  the  necessary  work  is  done 
to  insure  proper  initiation  of  the  next  phase. 


Activities 

The  time  and  logic  axes  define  a projection  of  the  morphology  which  is  often 
discussed  separately--the  Hall  Activity  Matrix.  This  matrix  is  shown  in 
Figure  3 [124]  , it  can  be  thought  of  as  the  "bottom  plane"  of  the  morpho- 
logical box  shown  in  Figure  1.  As  such,  it  is  independent  of  the  knowledge 
axis  and  is  therefore  independent  of  technology  or  the  application  area. 


Figure  3.  Hall  Activity  Matrix 
(from  I 1 24] ) 


An  element  of  the  matrix,  which  lies  at  the  intersection  of  a phase  and  a 
step,  is  called  an  activity.  Activities  therefore  are  the  use  of  some  aspect 
of  the  problem-solving  process  during  some  period  in  the  system  life  cycle. 
Activities  are  numbered  according  to  their  position  in  the  matrix;  thus 
Activity  (3,  4)  is  the  performance  of  the  Systems  Analysis  step  during  the 
System  Development  phase. 

The  Hall  Activity  Matrix  exhibits  all  possible  activities  but  does  not  imply 
that  all  of  them  are  performed  or  that  they  are  performed  in  a fixed 
sequence.*  It  is  therefore  a superior  notational  device  to  simple  mile- 
stone or  "waterfall"  charts  which  show  a misleadingly  linear  sequence  of 
events.  In  particular.  Hall  explicitly  recognized  that  certain  steps  are 
performed  iteratively  across  phases.  Thus,  Step  4 (Systems  Analysis,  or 
Deduce  Consequences  of  Alternatives)  may  be  repeated  as  Activities  (1,  4), 
(2,  4),  (3,  4),  etc.;  this  shows  the  successive  deduction  of  consequences 
of  alternatives  as  a project  moves  from  phase  to  phase. 

The  iterative  nature  of  Systems  Engineering  was  strikingly  depicted  by 
Hall  in  his  Spiral  Diagram  (Figure  4 [124]  ).  This  shows  the  richest 
possible  sequence  of  activities  converging  upon  a solution  or  operational 
system;  a segment  of  the  spiral  represents  the  successive  applications  of  a 
step  (element  of  the  problem-solving  process)  with  each  application 


*The  phases  of  the  time  dimension  must  naturally  be  followed,  and  steps 
which  depend  on  each  other  (3  and  4,  2 and  6,  etc.  ) must  naturally  occur 
in  the  proper  sequence.  The  matrix,  therefore,  defines  a partial  order- 
ing of  activities. 


Figure  4.  Hall  Activities  Represented  as  a Spiral  Converging  on  a Solution 
(One  revolution  of  the  spiral  is  a phase;  each  segment  is  the 
successive  application  of  a step.  ) 
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(activity)  coming  closer  to  the  solution  as  the  project  proceeds  from  phase 
to  phase.  This  iterative  structure  will  form  an  important  aspect  in  the 
development  of  payoff  formulae. 

Linkages 


Hall  recognized  but  did  not  develop  the  relationships  which  could  exist 
between  activities  and  the  information  flows  between  and  within  activities. 
These  relationships,  called  linkages,  were  explored  in  detail  by  Hill  and 
Warfield  [131]  . Their  principal  notation  for  expressing  linkages  were 
matrices.  There  are  two  kinds  used:  the  self-interaction  matrix  and  the 
cross -interaction  matrix. 

Self-interaction  matrices  are  used  to  express  the  relationships,  effects, 
or  influences  that  members  of  a class  of  elements  have  with  each  other. 

An  example  of  a class  of  elements  within  an  activity  is  objectives.  An 
objectives  self-interaction  matrix  can  therefore  be  used  to  determine 
whether  objectives  for  a program  conflict  with  or  support  one  another.  An 
example  of  an  objectives  self-interaction  matrix  for  a short  takeoff  and 
landing  (STOL)  aviation  program  is  shown  in  Figure  5 [131]  . 

Cross -interaction  matrices  are  used  to  show  the  relationships  which  may 
exist  between  the  needs  to  be  satisfied  by  a given  system  and  the  constraints 
imposed  by  the  environment  external  to  the  system.  An  example  of  a 
needs/constraints  cross-interaction  matrix  for  a STOL  program  is  given 
in  Figure  6 [131  ] . 
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TRANSPORTATION  SYSTEM 


Figure  5.  Example  of  a Self-Interaction  Matrix  (from  [131]) 
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Figure  fi.  Example  of  a Cross -Interaction  Matrix  (from  [131j) 
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Self-interaction  matrices,  since  they  deal  with  a single  class  of  elements, 
always  occur  within  an  activity.  Cross -interaction  matrices  can  either 
be  used  within  an  activity  or  to  show  linkages  between  activity.  An  example 
of  a set  of  self-interaction  and  cross -interaction  matrices  for  a single 
phase.  Program  Planning,  is  given  in  Figure  7.  The  number  of  matrices 
involved  in  just  one  phase  gives  an  indication  of  the  richness  of  the  linkage 
structure  for  a meaningful  program;  we  will  return  to  this  point  when  we 
present  a BMD  example. 

The  development  of  a linkage  structure  such  as  that  in  Figure  7 requires 
two  classes  of  decisions:  what  the  axes  of  the  matrices  are  to  represent 
(e.g,,  needs /constraints,  alte rabies /constraints)  and  what  relationship  is 
to  be  depicted  (e.g,,  "supports,"  "derived  as  a byproduct  of,"  etc.), 

PAYOFFS  IN  THE  SYSTEMS  ENGINEERING  CONTEXT 

Activities 


Having  adopted  the  Hall-Hill-Warfield  schema  as  a descriptive  device,  we 
now  restate  our  goal:  compare  CDP  and  DDP  in  the  context  of  BM-D  payoffs 
in  terms  of  activities  and  linkages. 

We  will  begin  by  identifying  the  activities  involved.  The  first  problem 
which  we  address  is  to  locate  the  phase  in  the  Hall  morphology  which  is 
appropriate  for  the  task  whose  results  are  being  presented.  There  are 
two  reasonable  alternatives:  Program  Planning  (Phase  i)  and  Project 
Planning  (Phase  2),  The  choice  is  made  clear  when  we  consider  Hall's 
definition  of  Project  Planning  [124 1 : 
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" Project  planning  is  distinguished  from  program  planning  by  interest 
focused  on  just  one  project  of  the  overall  program.  " 

If  we  regard  the  data  processing  subsystem  as  one  aspect  of  the  entire  BDM 
system,  then  we  are  clearly  engaged  in  Project  Planning.  The  next,  and 
more  important,  determination  is  what  steps  are  involved. 

I The  obvious  connotation  of  the  term  " BMD  payoff"  with  " benefit,  " " desired 

outcome,  " or  " objective"  leads  us  to  place  the  derivation  of  BMD  payoffs 
■ within  Step  2 of  the  Hall  matrix.  Value  System  Design.  Step  3,  Systems 

Synthesis,  has  been  done  by  default  with  the  postulating  of  the  alternatives 
i of  CDP  and  DDP.  Step  4,  Systems  Analysis,  will  be  performed  when  CDP 

I and  DDP  are  desci  ibed  or  characterized  in  a manner  which  permits 

comparison.  Step  5,  Decision  Making,  is  the  step  in  which  the  actual 
, comparison  will  be  made.  These  steps,  intersecting  with  our  choice  of 

1 I 

• Phase  2,  gives  the  following  definition  of  our  task: 

Activity  (2,  5),  compare  CDP  and  DDP,  preceded  by  Activities 
(2,  4),  deduce  consequences  of  CDP  and  DDP  and  (2,  2),  derive 

t 

BMD  Payoff  Value  System  as  basis  for  comparison. 

Tiiese  activities  are  shown  in  a Hall  Activity  Matrix  in  Figure  8,  along 
with  the  linkages  that  they  imply.  This  figure  also  shows  the  "missing 
linkages"  which  did  not  exist  at  the  start  of  this  task  or  which  are  not 
developed  as  part  of  it.  The  first  missing  linkage,  and  the  one  with  the 
greatest  consequences  for  our  example,  is  the  one  leading  from  Activities 
i (1,  1)  and  (2,  1),  Problem  Definition  for  Project  Planning,  and  Problem 

Definition  for  Program  Planning.  The  second  missing  linkage  is  the  one 


r * ^ 

[ 

[ 

i 

I 

which  leads  from  our  activities  to  later  phases;  this  is  a consequence  of  | 

the  scope  of  this  task,  which  was  to  provide  a meaningful  comparison  of  | 

1 CDP  and  DDP.  This  precluded  any  exploration  of  the  relationship  between  ] 

i payoffs  and  requirements.  This  subject  falls  properly  under  the  Axiomatic 

* 

i Requirements  Engineering  (ARE)  effort. 

i 

Before  we  drop  down  to  the  next  level  of  detail  and  start  discussing  specific 
notations  and  formats,  we  would  like  to  observe  that  we  have  placed  our  goal 
of  comparing  CDP  and  DDP  within  the  context  of  the  Hall -Hill- Warfield 
schema.  This  schema  uses  the  term  "system"  to  describe  the  entity 
- under  discussion;  we  replace  that  with  the  more  general  term  "technological 

alternative,  " by  which  it  is  inteded  that  "all  systems  which  use  this  | 

i alternative.  " Our  comparison,  and  the  activities  and  linkages  which  it 

‘ implies,  will  therefore  not  involve  as  rich  or  detailed  a structure  as  a 

i specific  system  would.  We  shall  expand  upon  this  point  when  we  have 

, presented  the  BMD  example.  j 

' 1 

i : 


We  did  consider  the  relationship  to  a small  degree  and  came  to  a 
preliminary  conclusion  that  a requirement  is  a mandatory  value  or  range 
of  values  for  a quantifiable  payoff. 
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REPRESENTATION  OF  BMD  PAYOFFS 


Importance  of  Notation 

Given  the  impact  of  representation  upon  method,  we  will  begin  with  a 
discussion  of  how  the  payoffs  should  be  organized.  This  issue  is  exceedingly 
important  because  the  decomposition  and  presentation  effort  is  severely 
influenced  by  the  tools  employed  for  its  realization.  This  is  not  a new  or 
novel  observation,  nor  is  it  unique  to  the  BMD  problem.  For  example, 
Whitehead  and  Russell  apologize  in  the  preface  to  the  Principia  for  the 

abundant  symbolism,  but  they  point  out  that  it  was  a necessary  requisite  to 
the  task  attempted.  That  is,  without  the  formal  tools  of  symbolic  manipula- 
tion, their  task  was  impossible.  The  limitation  may  essentially  lie  within 
the  human  mind.  The  same  is  true  here,  in  that  improper  selection  of 
tools  can  obscure  the  discovery,  comprehension,  and  representation  of 
payoffs. 

Hierarchies 

The  most  fundamental  and  prevalent  means  of  organizing  complexity, 
especially  the  complexity  which  is  derived  from  interrelationships,  is  the 
hierarchy.  This  observation  is  elegantly  made  by  Waller  [314]  and  Simon 
[272,  275 J and  is  supported  by  the  ease  with  which  we  can  find  instances  of 
hierarchies  in  a wide  range  of  disciplines.  We  mention  information  theory 
(information  flow),  pure  mathematics  (lattice  theory),  biology  (the 
hierarchical  nesting  of  organs,  cells,  etc. ),  decision  sciences  (PERT, 
decision  trees,  etc.).  Verbally,  we  may  simply  define  a hierarchy  as  a 
partially-ordered  structure  of  entities  in  which  every  entity  but  one  is 
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successor  to  at  least  one  other  entity,  and  every  entity  except  the  basic 
entities  is  a predecessor  to  at  least  one  other  entity. 

Hierarchies  as  defined  can  be  displyed  via  trees.  We  can  expand  upon  the 
above  so  that  the  root  entity  is  not  unique;  the  tree  becomes  a directed 
graph  with  multiple  roots.  In  summary,  the  term  hierarchy  simply  denotes 
a partially-ordered  set.  To  carry  out  the  ordering,  an  ordering  relation- 
ship is  required.  A proper  ordering  relationship  for  a hierarchy  must  be 
as  follows; 

• Binary- -It  must  be  between  two  elements. 

• Irreflexive--The  relation  must  not  exist  between  an  element 
and  itself.  The  relation  " equals"  is  not  irreflexive;  the 
relation  "is  the  father  of"  is. 

• Asymmetric- -If  entity  A has  the  relation  to  entity  B,  entity  B 
cannot  have  the  relation  to  A.  The  relation  " is  subordinate 
to"  is  asymmetric. 

• Transitive --If  a relation  holds  between  A and  B as  well  as  B 
and  C,  it  must  also  hold  between  A and  C. 

A hierarchical  structure  which  results  from  a proper  ordering  relationship 
possesses  a set  of  attributes  which  contributes  to  its  usefulness  as  a means 
of  organizing  complexity.  In  particular, 

• It  expresses  relationships  of  association  and  disassociation. 

• It  expresses  relationships  of  order  or  precedence. 

• It  permits  consideration  of  subsets  or  subhierarchies  which  have 
the  same  organizing  principle  as  the  entire  structure.  This  is 
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basic  to  effective  human  understanding  of  complexity  because 
it  enables  piecewise  consideration  of  a manageable  number  of 
entities. 

The  first  two  contribute  to  the  selection  process,  the  last  to  intellectual 
manageability.  Thus,  the  general  nature  of  hierarchies  made  them  an 
obvious  candidate  for  the  method  of  organization  of  BMD  payoffs.  Their 
attractiveness  was  enhanced  by  their  known  correspondence  with  binary 
matrices  1316  ] which  permit  the  use  of  automated  techniques  for  their 
generation  and  analysis. 

Hierarchies  were  selected  when  a review  of  existing  Value  System  Design 
techniques  showed  no  viable  alternatives  [319]  and  when  the  application  of 
the  hierarchical  structure  to  the  BMD  payoff  problem  produced  a meaningful 
example. 

Having  selected  the  hierarchy  as  the  organization  for  BMD  payoffs,  we 
must  define  the  two  aspects  of  the  hierarchy:  the  elements  and  the  relation- 
ship by  which  the  elements  are  organized.  We  shall  begin  with  a 
consideration  of  the  elements  of  a BMD  Payoff  Hierarchy. 

Elements  of  the  BMD  Payoff  Hierarchy 

This  effort  takes  us  to  Step  1 of  the  Hall  Activity  Matrix,  Problem  Defini- 
tion, An  early  positive  result  of  our  adoption  of  the  Hall-Hill-Warfield 
schema  was  the  way  it  clarified  the  cause  of  the  initial  difficulties  've  were 
having  with  payoffs:  namely,  that  no  Problem  Definition  steps  had  been 
performed  or  included  in  the  scope  of  the  contract.  This  defined  the  first  of 
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the  missing  linkages  shown  in  Figure  8,  As  a consequence.  Activity  (2,  2), 
Value  System  Design,  had  to  proceed  without  inputs.  We  will  therefore 
digress  from  our  main  argument  long  enough  to  describe  how  we  compensat- 
ed for  this  missing  linkage. 


We  began  by  recalling  the  purpose  of  the  BMD  payoff  hierarchy:  to  provide 
a context  in  which  CDP  and  DDP  could  be  compared.  The  hierarchy 
should  therefore  possess  at  least  two  key  attributes: 

• It  must  be  problem  relevant;  that  is,  it  must  properly  reflect 
the  nature  of  the  BMD  problem. 

• It  must  be  solution  relevant;  that  is,  it  must  contain  information 
which  can  be  related  to  technology. 


We  considered  these  two  requirements  for  the  hierarchy  and  reviewed  the 
informal  and  intuitive  payoff  discussions  which  were  the  source  documents 
for  this  task.  As  a result,  we  arrived  at  a preliminary  partitioning  of  the 
BMD  problem  into  three  parts: 


A policy  which  embodies  the  stated  will  of  the  U.S.  Government 
with  regard  to  survival  and  sovereignty, 

A threat  which  seeks  to  negate  that  policy,  either  through  outright 
attack  or  intimidation  through  threat  of  a successful  attack,  and 


A BMD  system  which  actively  enforces  the  policy  in  the  face  of 
the  threat  by  reducing  the  effect  of  an  outright  attack  or  by 
preventing  intimidation  by  being  clearly  able  to  reduce  the 
effect  of  any  potential  attack. 
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Figure  8.  Linkages  Used  in  this  Report 


Given  this  breakdown,  it  is  clear  that  the  BMD  payoff  hierarchy  falls  under 
the  area  of  policy;  the  system  (or,  in  our  case,  the  technical  alternatives 
for  the  implementation  of  the  system)  is  the  object  being  compared,  and  the 
threat  is  part  of  the  outside  environment.  Placing  payoffs  as  part  of 
policy  is  also  consistent  with  the  previous  informal  and  intuitive  discussions 
of  payoffs:  each  statement  like  "the  system  must  adapt  to  new  threats" 
represents  a " common  sense"  generalization  from  an  " obvious"  but 
unstated  policy  about  continued  survival  and  sovereignty. 

Placing  the  BMD  payoff  hierarchy  in  the  policy  area  then  exposes  two  lowex’- 
level  problems: 

• It  is  not  clear  what  a policy  looks  like  when  organized  or 
embodied  in  a payoff  hierarchy. 

• It  is  not  clear  how  the  payoffs  in  the  hierarchy  relate  to  the 
mandatory  requirements  which  the  system  must  meet. 

The  second  problem  is  a manifestation  of  the  second  missing  linkage  in 
Figure  8,  the  one  which  should  lend  to  activities  in  later  phases. 
Establishment  of  this  linkage  is  outside  the  scope  of  this  task  and  thus  we 
will  only  discuss  the  first  problem. 

We  then  return  to  the  two  attributes  which  we  said  the  elements  of 
hierarchy  must  have:  problem  relevance  and  solution  relevance. 

Solution  relevance  means  that  the  payoffs  must  be  useful  to  a practitioner 
in  some  technological  area;  it  must  enable  him  to  gauge  the  quality  of  an 
existing  solution  (e.  g. , an  element  of  a BMD  system)  or  to  select  the  most 
promising  among  several  technological  alternatives  (such  as  CDP  and  DDP). 
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This  in  turn  means  that  the  payoffs  must  be  expressed  in  technological 

terms,  which  are  necessarily  system  dependent  to  a greater  or  lesser  ■ j 

degree.  This  is  an  important  point  and  one  which  we  will  return  to  when  we  | i 

discuss  ways  of  achieving  quantifiable  payoffs.  At  the  present  stage  of  j | 

our  discussion,  we  will  recognize  the  system  dependencies  of  payoffs  by  I | 

defining  them  to  be  measurable  or  observable  attributes  of  a BMD  system  I J 

which  correspond  to  (or  embody,  or  are  derived  from)  the  policy  which  that  r l 

system  is  to  enforce  in  the  face  of  the  threat.  Since  our  primary  goal  in 
this  task  deals  with  technological  alternatives  (CDP  and  DDP)  for  data  ! 

processing  subsystems,  the  payoffs  we  define  will  be  measurable  or  j * 

observable  attributes  of  data  processing  subsystems.  Since  no  linkage  to  \ 

■ ) 

a Step  1 (Problem  Definition)  exists  for  this  effort,  we  will  derive  the 
payoffs  in  our  example  by  informal  means  from  a simple  policy  of  survival 
and  maintenance  of  sovereignty.  We  now  return  to  our  main  argument  and 
continue  the  reasoning  which  led  us  to  the  particular  hierarchy  used  in  the 
example. 

Organizing  Principle  of  a BMD  Payoff  Hierarchy 

. i 

We  have  selected  the  hierarchy  as  the  organizing  device  for  BMD  payoffs 

and  defined  measurable  or  observable  DP  subsystem  characteristics  as 

the  elements  of  the  hierarchy.  We  also  established  that  these  elements  i 

(individual  payoffs  or  individual  DP  subsystem  characteristics)  must  ' J 

relate  to  some  policy.  For  purposes  of  our  example  and  discussion  we  1 j 

are  satisfied  with  an  informal,  intuitive  relation  to  a very  general  policy  of 

national  survival  under  attack  and  maintenance  of  national  sovereignty  under  ; ; 

threat  of  attack.  ! : 


We  now  consider  a relationship  between  payoffs  which  will  enable  them  to 
be  organized  into  a hierarchy  which  can  be  mapped  onto  or  related  to  the 
policy.  The  relationship  must  satisfy  the  hierarchical  constraints  of  being 
binary,  irreflexive.  asymmetric,  and  transitive.  A relationship  which 
satisfies  these  constraints  and  corresponds  to  our  intuitive  notion  of  payoffs 
is  the  relation  " significantly  contributes  to.  " This  relation  is  also 
attractive  because  it  supports  the  ultimate  establishment  of  quantifiable 
payoffs:  if  payoffs  A,  B,  and  C significantly  contribute  to  payoff  D,  then  we 
can  postulate  a formula  of  the  form  D = f(A,  B,  C)  and  begin  to  discuss  the 
nature  of  f(). 

LINKAGES  TO  OTHER  ACTIVITIES 
Description  of  Technological  Alternatives 

Our  success  with  the  hierarchical  technique  in  organizing  payoffs  led  us  to 
try  it  for  technological  alternatives.  We  accordingly  listed  all  the 
relevant  characteristics  of  distributed  and  centralized  processing  technology 
and  then  tried  pairwise  comparisons  with  a variety  of  relations.  No 
meaningful  structures  resulted,  so  in  the  interest  of  progress,  we  organized 
the  characteristics  in  the  form  of  a simple,  unranked  list. 

Non-Hierarchical  Interactions 

The  fact  that  the  individual  attributes  of  a technological  alternative  cannot 
be  organized  into  a hierarchy  does  not  mean  that  they  are  completely  dis- 
joint. Like  other  elements  in  the  system  development  process,  they  may 
interact  by  means  of  relationships  which  would  not  yield  a hierarchy,  that 
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is,  relationships  which  are  not  binary,  irreflexive,  asymmetric,  or 
transitive.  Such  non -hierarchical  relationships  can  be  represented  by 
means  of  a self-interaction  matrix. 

A variety  of  interactions  could  be  encoded  in  such  a matrix.  We  decided 
that  a useful  one  to  depict  would  be  the  interaction  or  " coupling"  which 
would  occur  between  the  characteristics  promised  by  a technological 
alternative  when  an  implementation  using  that  alternative  was  attempted. 

Such  an  interaction  between  two  attributes  exists  when  achievement  of  one 
occurs  at  the  expense  of  another  (negative  interaction)  or  as  a byproduct 
(positive  interaction).  For  example,  there  is  a positive  interaction  in  the 
DDP  technology  between  the  characteristic  "small  processors"  and 
"simple  processors"  since  the  implementation  of  one  generally  results  in 
the  other. 

We  felt  that  these  " coupling"  interactions  would  be  useful  in  assessing  the 
merits  of  a particular  technological  alternative.  In  order  to  represent  the 
possible  range  of  interactions,  we  had  to  expand  the  original  Hill-Warfield 
values  of  " strong"  and  "weak"  [131]  into  five  values.  Our  values  and  the 
meanings  they  assume  for  this  set  of  interactions  are  the  following: 

• Strong  Positive --One  characteristic  is  very  often  a byproduct 
of  the  other. 

• Weak  Positive --One  characteristic  is  sometimes  a byproduct 
of  the  others. 

• Interdeterminate- -The  characteristics  relate  in  a manner  not 
known  now. 


• Weak  Negative- -One  characteristic  must  sometimes  be  traded 
off  against  the  other. 

• Strong  Negative --One  characteristic  must  very  often  be 
traded  off  against  the  other. 

The  Ends/Means  Matrix 

We  return  now  to  our  basic  goal  of  comparing  CDP  and  DDP  within  the 
context  of  HMD  payoffs.  Our  use  of  the  Hall -HiU- Warfield  schema  leads 
us  to  represent  this  comparison  as  a linkage  in  the  form  of  cross -inter- 
action matrix.  We  therefore  have  two  things  to  determine:  what  the 
dimensions  of  the  matrix  should  represent,  and  what  interaction  should  be 
encoded  in  the  matrix.  We  will  begin  by  considering  the  dimensions.  One 
dimension  of  the  matrix  must  clearly  be  the  characteristics  of  the 
technologies  being  compared.  These  characteristics  represent  the  means 
provided  by  that  technology.  For  our  example  we  will  consider  the 
characteristics  of  CDP  and  DDP  as  constituting  one  partitioned  set  of  means 
so  that  comparison  can  be  made  with  reference  to  a single  matrix. 

The  obvious  choice  for  the  second  dimension  of  the  matrix  is  the  individual 
BMD  payoffs.  Each  element  of  the  cross -interaction  matrix  then  depicts 
a potential  relationship  between  an  attribute  of  a given  technological 
alternative  and  a BMD  payoff.  This  leads  to  another  choice  in  the  organiza- 
tion of  the  matrix:  whether  the  payoff  dimension  should  list  all  the  payoffs 
or  only  those  at  the  bottom  level  of  the  hierarchy.  We  chose  to  list  only 
those  at  the  bottom  level  for  the  following  reasons: 
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• The  nature  of  the  relation  " significantly  contributes  to"  forces 
a gross  ordering  on  the  elements  of  the  payoff  hierarchy. 

This  ordering  proceeds  from  the  general  (at  the  top)  to  the 
specific  (at  the  bottom).  The  bottom -level  payoffs  are 
therefore  the  most  specific  and  detailed  elements  of  policy 
that  are  available  for  comparison. 

• The  hierarchy  itself  already  shows  the  "flow"  of  the  inter- 
actions through  the  higher -level  payoffs.  Thus  a technology 
attribute  which  interacts  with  a bottom -level  payoff  is  already 
placed  in  context  by  the  existence  of  the  hierarchical  relations 
between  the  bottom -level  payoff  and  the  higher -level  (or  more 

t general)  payoffs. 

i 

In  addition  to  making  this  choice  for  the  dimensions  of  the  cross -interaction 
matrix,  we  extended  the  Hill-Warfield  notation  in  the  same  manner  as  we 
did  for  self-interaction  matrices.  The  resulting  five  values  and  the 
meanings  assigned  to  them  in  the  Ends /Means  Matrix  are  as  follows: 


• Strong  Positive  Interaction- -The  given  means  very  often 
support  achievement  of  the  given  end. 

i 

• Weak  Positive  Interaction- -The  given  means  sometimes  support  j 

achievement  of  the  given  end.  | 

• Indeterminate  Interaction- -The  given  means  may  support  or 

! 

may  conflict  with  achievement  of  the  given  end. 

• Weak  Negative  Interaction- -The  given  means,  when  used  to 
achieve  some  other  end,  will  sometimes  conflict  with  the 
achievement  of  the  given  end. 
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• strong  Negative  Interaction- -The  given  means,  when  used  to 
achieve  some  other  end,  will  very  often  conflict  with  the 
achievement  of  the  given  end. 

The  complete  linkage  structure  which  resulted  from  the  above  reasoning 
is  shown  in  Figure  9,  This  is  the  linkage  structure  which  will  be  used 
in  the  BMD  example- -the  results  of  our  original  goal  of  comparing  CDP  and 
DDP. 

Observations  on  the  Linkage  Structure 

We  developed  a linkage  structure  in  this  task  for  two  reasons:  to  provide 
an  orderly  comparis  jn  of  CDP  and  DDP,  and  to  give  a basis  for  the 
development  o^  quantifiable  payoffs.  It  is  therefore  only  a fragment  of  the 
linkage  structure  which  would  be  necessary  to  describe  the  BMD  problem. 
The  scope  of  a full-fledged  linkage  structure  can  be  gauged  by  examining 
the  example  presented  in  Hill  and  Warfield  [131].  Their  example  deals 
with  the  linkages  that  would  exist  only  in  the  Program  Planning  phase  of  a 
project  to  develop  a commercial  STOL  capability.  This  example  uses  18 
matrices  which  show  the  interactions  between  eight  different  classes  of 
elements  in  such  a program:  Objectives,  Objective  Measures,  Activities, 
Activity  Measures,  Agencies,  Constraints,  Needs,  and  Alterables,  The 
largest  matrix  (Activities  interacting  with  Activities  Measures)  is  45  x 41. 
Their  STOL  program  is  considerably  simpler  than  the  BMD  data  processing 
problem,  and  the  level  of  detail  they  provide  is  insufficient  for  any 
meaningful  engineering  judgments.  This  indicates  that  we  have  but  set  a 
direction  and  made  a beginning;  we  feel  that  the  direction  is  a proper  one. 
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DERIVATION  OF  BMD  PAYOFFS 


OVERVIEW 

We  now  turn  our  attention  toward  the  addition  of  content  to  the  forms  which 
we  have  defined  or  selected  in  the  preceding  sections.  We  begin  with  the 
most  important  and  complex  of  these  forms,  the  payoff  hierarchy.  This 
hierarchy  is  produced  by  means  of  a payoff  derivation  methodology. 


The  purpose  of  the  payoff  derivation  methodology  is  to  capture  the  knowledge 
and  intuition  of  policy  makers  in  a form  which  is  technologically  relevant. 

To  achieve  this  purpose  we  adapted  the  technique  of  interpretive  structural 
modelling  (ISM)  as  developed  by  Warfield  [315  J.  The  specific  steps  which 
we  present  in  our  overview  are  derived  from  those  of  Waller  [314]. 


The  methodology  produces  a hierarchy  of  BMD  payoffs  through  the 
performance  of  the  following  steps: 

1,  Assemble  interdisciplinary  team  of  technologists  and 
policy  makers. 

2,  Produce  a preliminary  list  of  potential  BMD  payoffs. 

3,  Refine  the  list  of  BMD  payoffs. 


4.  Do  a pairwise  comparison  of  individual  payoffs  using  the 
relation  " significantly  contributes  to"  and  encode  the 
results  of  the  comparisons  in  a binary  matrix, 

5.  Convert  list  of  payoffs  and  the  encoded  comparisons  to  a 
hierarchy. 

6.  Evaluate  and  refine  the  resultant  hierarchy. 

These  steps  are  expanded  in  the  following  subsection. 

PAYOFF  DERIVATION  METHODOLOGY 

Assemble  Team 

The  great  strength  of  ISM  is  its  ability  to  consolidate  the  knowledge  and 
intuition  of  individuals  from  a variety  of  backgrounds  [314  J,  This  strength 
should  be  used  in  any  meaningful  BMD  payoff  exercise.  As  a minimum, 
the  team  should  consist  of  policy  makers,  individuals  with  experience  in 
problem  characterization  (i.  e, , simulation  and  operations  research),  and 
representatives  of  technology  areas  which  will  be  involved  in  the  achievement 
of  the  payoffs.  The  team  should  be  presented  with  the  policy  for  the  BMD 
system  of  subsystem  for  which  the  payoffs  are  being  derived.  If  a policy 
is  not  available,  the  team  should  be  given  the  responsibility  of  establishing 
that  policy  in  its  form  of  an  interrelated  structure  of  decomposed  elements, 
i,  e. , a payoff  hierarchy. 


Produce  Preliminary  Payoff  List 


The  team  should  then  generate  a preliminary,  unstructured  list  of  payoffs 
and  their  associated  definitions. 

Refine  Payoff  List 

The  preliminary  list  is  reviewed  by  the  team  for  completeness  and 
redundancy.  Once  the  team  is  satisfied  that  a complete  list  has  been 
produced  and  that  no  payoffs  are  defined  twice  under  different  names,  the 
payoff  definitions  should  be  made  as  precise  as  possible. 

Do  Pairwise  Comparison 

The  team  then  undertakes  a pairwise  comparison  of  all  the  payoffs  in  the 
list.  For  each  pair  of  payoffs,  the  team  determines  the  presence  or 
absence  of  the  relationship  " significantly  contributes  to,  " The  results 
of  the  comparison  are  encoded  in  a binary  matrix  l314j. 

Produce  Hierarchy 

The  binary  matrix  is  then  converted  to  the  graphic  form  of  a hierarchy  for 
purposes  of  review  by  the  team.  This  conversion  can  be  done  manually 
[314]  or  by  automated  techniques  [314,  315,  316,  317].  Automated 
techniques  are  recommended  because  the  manual  ones  are  tedious,  time- 
consuming,  and  error -prone. 


Evaluate 


The  team  then  reviews  the  hierarchy  and  decides  whether  it  satisfactorily 
represents  their  knowledge  and  intuition. 

Refine 


It  is  very  likely  that  the  early  hierarchies  will  contain  many  apparent 
anomalies,  in  that  the  results  of  the  individual  payoff  definitions  and  their 
pairwise  comparisons  will  not  correspond  to  the  team's  intuitive  notion  of 
a "right"  structure.  Expressed  in  BMD  terms,  typical  anomalies  which 
occur  in  ISM  exercises  [314]  include: 

• Payoffs  which  occupy  counterintuitive  positions  in  the 
hierarchy.  Payoffs  which  are  " obviously"  high  level  may 
end  up  at  low  levels  in  the  hierarchy  and  vice-versa.  This 
requires  review  of  the  pairwise  comparisons.  A major 
advantage  of  ISM  in  handling  this  class  of  anomaly  is  the 
manner  in  which  it  focuses  the  team  on  consideration  of 
intellectually  manageable  pairwise  comparisons  rather  than 
unguided  review  of  an  entire  complex  structure  [314]. 

• Inability  to  produce  a single  hierarchy.  The  set  of  all 
pairwise  comparisons  may  result  in  two  or  more  disjoint 
hierarchies  [314].  This  is  an  indication  that  not  all  the 
payoffs  in  the  list  are  interrelated  by  the  relation  " significantly 
contributes  to, " This  may  result  from  redundant  payoffs 
where  essentially  the  same  thing  is  defined  in  different  words. 
Another  cause  of  disjoint  hierarchies  is  the  omission  of  a 
necessary  payoff  which  links  the  hierarchies  together. 


Resolution  of  the  anomalies  will  require  the  repetition  of  some  of  the 
previous  steps.  This  iterative  aspect  of  ISM  gives  another  reason  for  the 
use  of  automated  tools  to  convert  the  sets  of  pairwise  comparisons  (binary 
matrices)  into  graphic  hierarchies. 

USE  OF  THE  METHODOLOGY 

Overview 


We  shall  now  illustrate  the  payoff  methodology  by  producing  an  example  of  I 

a payoff  hierarchy.  This  example  hierarchy  will  also  provide  the  basis  for  s 

I 

the  comparison  of  DDP  and  CDP  in  the  context  of  BMD  payoffs.  The 
example  is  limited  by  the  contract  scope  and  the  resultant  reliance  on 
manual  techniques  for  hierarchy  generation;  it  is,  however,  comprehensive 
enough  to  show  the  power  of  the  ISM  technique  as  well  as  the  inherent 
advantages  of  DDP. 

The  Starting  Problem 

The  very  first  observation  which  was  made  by  the  example  payoff  team  was 
the  absence  of  an  available  BMD  policy  to  guide  the  production  of  the 
hierarchy.  This  was  a reflection  of  the  point,  which  we  already  noted,  ] 

that  the  scope  of  the  task  was  in  the  middle  of  the  Hall  Activity  Matrix  and 
that  in  particular  (in  his  terms)  there  did  not  exist  a defined  linkage 
between  the  Hall  activities  which  involve  Problem  Definition  and  this 

activity.  | 

1 

I 


38 


I 

1 


The  team  accordingly  decided  to  initiate  their  effort  by  postulating  top-level 
payoffs  which  would  be  generic  in  that  they  would  correspond  to  a wide 
rai^e  of  intuitively  " reasonable"  policies.  This  enabled  work  to  progress 
at  the  expense  of  clarity  of  definition. 


Establishing  these  top-level  payoffs  began  by  postulating  a life-cycle  model  j 

of  a BMD  system.  This  model  is  defined  in  terms  of  intervals  and  trans  - | 

itions  (figure  10).  An  interval  was  defined  as  a period  in  the  life  cycle 
and  a transition  as  an  event  which  marks  the  boundary  between  two  intervals. 

The  life -cycle  model  begins  with  the  transition  of  commitment,  which  is 
the  decision  to  deploy,  and  continues  through  deployment  and  use.  It 
therefore  does  not  include  any  events  or  activities  associated  with  research 
and  development  or  program  planning.  This  choice  of  span  of  the  life 
cycle  was  made  so  that  the  model  and  the  policy  derived  from  it  would 
include  the  periods  during  which  the  payoffs  are  manifest  rather  than  the 
periods  when  the  payoffs  are  defined  or  made  possible.  Thus  a research 
and  development  activity  may  develop  a technology  which  makes  fault 
tolerance  possible,  and  a program  planning  activity  may  select  that 
technology;  but  the  system  will  not  manifest  fault  tolerance  until  the 
system  exists.  In  Hall's  terminology,  we  would  say  that  payoffs  from 
technology  (which  are  the  class  we  are  considering  in  our  example)  only 
occur  or  manifest  themselves  during  Phases  3 through  6:  System  Develop- 
ment, Construction,  Phase  In,  and  Operations.  Our  life-cycle  model  and 
its  relation  in  the  Hall  phases  is  given  in  Figure  11.  ' 


Having  defined  an  appropriate  life- cycle  model,  the  team  then  decided  to 
proceed  in  a top-down  fashion.  They  accordingly  began  with  a top-level 
payoff  of  sovereignty  and  survival  and  defined  two  second-level  payoffs: 
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deployability  and  utility.  Deployability  subsumes  all  policy  aspects  having 
to  do  with  the  deployment  of  a BMD  system,  and  utility  subsumes  all 
policy  aspects  of  the  system  once  it  is  in  place. 

The  team  regarded  this  initial  partitioning  as  intuitively  satisfying  since  it 
segregated  all  policy  considerations  into  two  broad  classes:  one 
associated  with  a positive  answer  to  the  question  " Can  the  system  be 
deployed  ?"  and  the  other  associated  with  a positive  answer  to  " Will  the 
system  serve  a useful  purpose  ?" 

The  team  then  performed  a further  decomposition  of  deployability  and 
utility,  guided  by  the  intervals  and  transitions  of  the  life-cycle  model. 

The  resulting  top  three  levels  of  the  payoff  hierarchy,  and  the  intervals  or 
transitions  of  the  life -cycle  model  to  which  they  correspond,  are  shown  in 
Figure  12. 

Development  of  the  Hierarchy 

The  team  then  proceeded  to  develop  and  refine  a list  of  subsidiary  payoffs. 
The  resulting  payoff  definitions  are  given  in  Figure  13.  The  individual 
payoffs  were  subjected  to  pairwise  comparison,  and  hierarchies  were 
produced  and  evaluated.  The  example  presented  here  represents  the 
third  revision  of  the  hierarchy.  The  first  version  was  produced  by  means 
of  a manual  transformation  from  a binary  matrix;  subsequent  versions 
were  manipulated  directly.  This  deviation  from  the  ISM  methodology  was 
caused  by  the  extreme  clerical  problems  imposed  by  the  manual  method. 

It  was  clear  from  even  this  limited  exercise  that  a full-scale,  computer - 
supported  ISM  effort  on  the  payoff  hierarchy  would  have  yielded  significant 
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Figure  12.  Top  Three  Layers  of  Payoffs  and  Portions  of 
Life  Cycle  within  which  They  Are  Manifest 


Top-Level  Payoff 

National  sovereignty  and  survival--The  basic  purpose  of  a BMD  system. 
Second-Level  Payoffs 

Deployability— All  aspects  of  the  system  which  contribute  to  deployment. 
Utility--All  aspects  of  the  system  which  contribute  to  its  usefulness 
once  in  place. 

Third-Level  Payoffs 

Confidence--The  degree  of  confidence  that  a deployed  system  will  work. 
Constructability— The  ease  with  which  the  system  can  be  built. 
Demonstrability--The  degree  to  which  the  system  can  demonstrate  its 
capability  in  a test  or  exercise  mode. 

I 

Readiness--The  extent  to  which  the  system  is  ready  to  go  to  war. 

Response— The  quality  of  the  system's  response  to  attack. 

Effectiveness--The  quality  of  the  defense  subsequent  to  attack. 

Fourth-Level  Payoffs 

Avail ability--The  percentage  of  time  that  the  system  is  up  and  ready  to 
defend. 

Longevity--The  period  of  time  over  which  the  system  resists  obsolescence. 
Performance--The  quality  of  defense  provided  by  the  system. 

Tenacity— The  ability  of  the  system  to  maintain  performance  under  pressure 


Fifth-Level  Payoffs 

Foreseen  Feasibility--The  predicted  feasibility  of  the  system. 

Foreseen  Adequacy--The  predicted  degree  to  which  the  system  will  enforce 
the  policy. 

Security— The  ability  of  the  system  to  resist  non-nuclear  attack. 
Maintainability--The  degree  to  which  the  system  can  be  kept  in  a fault- 
free  state. 


Figure  13.  Payoff  Definitions 


Graceful  Degradation— The  ability  of  the  system  to  avoid  collapse  as 
elements  are  lost. 

Graceful  Saturation--The  ability  of  the  system  to  avoid  collapse  under 
overload. 

Sixth-Level  Payoffs 

Foreseen  Low  Risk— The  predicted  absence  of  risk  of  the- deployment  of 
the  system. 

Foreseen  Correct  Functionality—  The  predicted  correct  behavior  of  the 
[ deployed  system. 

Foreseen  Adequate  Performance--The  predicted  adequacy  of  the  deployed 
system. 

Predictable  Performance— The  degree  to  which  the  performance  of  the 
deployed  system  can  be  predicted. 

Low  Cost— The  economy  with  which  the  system  can  be  deployed. 

Short  Time— The  speed  with  which  the  system  can  be  deployed. 

Fault  Tolerance— The  degree  to  which  the  system  minimizes  the  effect 
of  a fault. 

Reliability--The  absence  of  faults. 

Functional  Adaptability— The  ability  to  change  functionality  in 
response  to  new  threats. 

Growth— The  ability  to  handle  increased  numbers  of  existing  threats. 

Loss  Tolerance— The  ability  to  continue  operation  as  elements  of  the 
system  are  destroyed. 

Bottom-Level  Payoffs 

Predicable  Cost--The  degree  to  which  the  cost  of  deployment  can  be 
predicted. 

Foreseen  Low  Cost— The  predicted  economy  of  deployment. 

Foreseen  Short  Time— The  predicted  speed  of  deployment. 


Figure  13.  Payoff  Definitions  (continued) 


Predictable  Time— The  degree  to  which  the  speed  of  deployment  can  be 
predicted. 

Technically  Robust--The  success  of  the  system  does  not  depend  on  the  success 
of  a small  number  of  technical  breakthroughs. 

Alternate  Implementation--The  ability  of  a given  design  to  be  built 
several  ways. 

Function  Testable--System  elements  can  be  tested  on  a per-f unction  basis. 

Mass  Production--Smal 1 system  elements  can  be  built  in  large  numbers. 

Rapid  Integration--The  speed  with  which  system  elements  can  be  combined. 

"Slice"  Testable— The  system  can  be  tested  by  an  interception  of  a single 
object. 

Formally  Verifiable--Critical  software  can  be  proved. 

Fault  Detection--The  ability  of  the  system  to  locate  a fault. 

Fault  Isolation--The  ability  of  the  system  tc  contain  a fault. 

Reconfiguration--The  ability  to  move  load  and  functionality  to  alternate 

system  elements. 

Maintainer  Quality—  The  effectiveness  of  the  maintenance  organization. 

Processor  Reliability--Freedom  from  fault  o^  the  processors. 

Link  Reliability— Freedom  from  fault  of  the  interprocessor  links. 

Programmability--The  ease  with  which  software  can  be  written  for  the 
system. 

Functional  Modularity--The  ease  with  which  new  functions  can  be  added 
to  the  system. 

Load  Modularity--The  ease  with  which  capacity  can  be  added  to  the  system. 

Capacity--The  number  of  objects  the  system  can  defend  against. 

Correctness— The  ability  of  the  system  to  perform  proper  actions  upon 
attack. 

Time! iness--The  ability  of  the  system  to  perform  quickly  upon  attack.  j 

Real-Time  Adaptability— The  ability  of  the  system  to  deal  with  unforeseen 
events. 

Figure  13.  Payoff  Definitions  (continued) 
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Loss  Detection--The  ability  of  the  system  to  locate  destroyed  elements. 

Loss  Isolation--The  ability  of  the  system  to  trinitrize  the  effect  of 
destroyed  elements. 

Real-Time  Reconfigurability--The  ability  of  the  system  to  move  load  and 
functionality  off  of  destroyed  elements. 

Element  Survivability"The  number  of  system  elements  which  avoid 
destruction. 

Figure  13.  Payoff  Definitions  (concluded) 


results  by  permitting  the  calculation  and  presentation  of  results  for  a 
much  larger  and  more  detailed  set  of  payoffs.  A frequent  source  of  change 
in  the  development  of  the  hierarchy  was  the  inability  of  the  team  to  agree  on 
the  relationship  between  a bottom -level  payoff  and  those  above  it.  This 
\ inability  to  agree  would  cause  a detailed  examination  of  the  definition  of 

the  bottom -level  payoff.  The  examination,  in  turn,  often  resulted  in  a 
decomposition  of  that  payoff  into  a subhierarchy.  The  net  result  was  a great 
deal  of  iteration,  far  more  than  the  manual  methods  could  handle. 
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SECTION  4 


DDP  RATIONALE 


OVERVIEW 

We  are  now  prepared  to  present  the  results  whose  achievement  formed  our 
original  goal:  the  comparison  of  CDP  and  DDP.  These  results  will  use 
the  formats,  notations,  and  structure  which  resulted  from  the  effort 
described  above.  There  are  three  results:  the  BMD  payoff  hierarchy, 
the  technology  characteristics  self-interaction  matrix,  and  the  Ends /Means 
Matrix. 

PRESENTATION  OF  RESULTS 

BMD  Payoff  Hierarchy 

The  BMD  payoff  hierarchy  which  resulted  from  our  ISM  exercise  is  shown 
in  Figure  14. 

Technology  Self- Interaction  Matrix 

The  matrix  in  Figure  15  shows  the  interactions  which  exist  between  various 
characteristics  of  data  processing  technology.  The  interaction  between 
two  characteristics  is  that  which  we  defined  when  we  presented  the  linkage 
structure:  whether  the  act  of  implementing  a system  using  this  technology 
implies  a relationship  or  " coupling"  between  characteristics  of  the 
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Figure  15.  Technology  Self-Interaction  Matrix 
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technology.  This  " coupling"  can  be  positive  as  when  a characteristic 
occurs  as  a byproduct  of  another,  or  it  can  be  negative,  as  when  a conflict 
exists. 

An  example  of  a conflict  is  the  interaction  between  standardized  processors 
and  simple  processes;  setting  a standard  for  processors  means  that  some 
of  them  may  not  have  the  special  capabilities  required  to  support  certain 
processing  needs.  This  in  turn  means  that  some  processes  would  have  to 
be  more  complex  than  necessary  because  they  would  be  implemented  on 
inappropriate  processors.  Therefore  the  characteristic  of  standard 
processors  interacts  negatively  with  the  characteristic  of  simple  processes 
when  a system  implementation  is  attempted. 

For  the  sake  of  simplicity  of  presentation,  we  show  all  characteristics  of 
data  processing  technology  in  a single  matrix,  regardless  of  whether  they 
are  derived  from  CDP  or  DDP;  the  matrix  is  divided  into  zones  to  show  the 
two  technological  alternatives. 

Ends /Means  Matrix 


The  relationship  between  technology  and  payoffs  is  shown  in  the  matrix  of 
Figure  16.  As  with  the  self-interaction  matrix,  we  show  both  CDP  and 
DDP  technical  characteristics  on  one  axis  and  divide  the  matrix  into  zones 
in  order  to  permit  comparison. 
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Figure  16.  Ends /Means  Matrix 


In  support  of  the  Ends/Means  Matrix,  and  as  a preUminary  step  toward 
quantified  payoffs,  we  developed  a set  of  curves  which  support  the  strong 
positive  interactions  given  between  certain  characteristics  of  DDP 
technology  and  BMD  payoffs.  These  curves  are  given  in  Figures  17  through 
26,  Each  figure  is  accompanied  by  a short  argument  which  justifies  its 
form.  Many  of  these  curves  show  very  simple  and  obvious  relaticxi ships; 
greater  subtlety  and  exactness  requires  more  knowledge  of  the  BMD 
construct  which  is  using  DDP  in  its  data  processing  subsystem.  We  wiU 
expand  on  this  point  in  the  next  section. 

OBSERVATIONS  ON  RESULTS 


Overall  Observations 

As  we  observed  when  we  presented  the  linkage  structure,  the  scope  and 
focus  of  this  task  kept  us  from  developing  results  of  adequate  richness. 

The  lack  of  a firm  and  stated  BMD  policy  (in  the  sense  of  the  problem  break- 
down into  policy,  threat,  and  system)  forced  us  to  postulate  " generic"  or 
" common  sense"  payoffs  in  order  to  derive  a payoff  hierarchy.  We  feel 
that  the  outcome  represents  a minimum  reasonable  payoff  hierarchy,  one 
from  which  broad  conclusions  can  be  drawn. 

The  technology  characteristics  which  we  present  are  limited  to  the  data 
processing  technologies  of  CDP  and  DDP,  Review  of  actual  data  process- 
ing development  efforts  such  as  Safeguard  and  the  Modular  Missile -Borne 
Computer  indicate  that  there  are  interactions  (trade-offs)  between  ^ the 
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The  cost  of  electronic  components  is  dropping  at  a nonlinear  rate.  Single- 
chip, general-purpose  processors  have  wide  potential  use  in  consumer  products. 
This  permits  them  to  be  made  in  larger  quantities  than  other  components,  and 
their  price  drop  is  accordingly  faster  than  average.  Minicomputers  and  maxi- 
computers contain  a lesser  or  greater  labor  component  in  their  cost;  this 
prevents  them  from  dropping  in  cost  as  rapidly  as  the  single-chip  processors. 
Since  labor  costs  are  rising  approximately  linearly,  the  gap  in  price  (for 
an  equivalent  gap  in  functionality)  between  single-chip  processors  and 
mini/maxicomputers  should  therefore  widen. 


Figure  17.  Justification  for  Strong  Positive  Interaction 
between  Small  Processors  and  Low  Cost 
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EXPERIENCE 


FOLKLORE 


20  40  60  80 

PERCENT  OF  SPEED  AND  MEMORY  USED  BY  SOFTWARE 

PERCENT  OF  SPEED  AND  MEMORY  USED  BY  ENSEMBLE  OF  PROCESSORS  FOR  A TASK 

(b)  PERCENT  OF  SPEED  AND  MEMORY  USED  BY  UNIPROCESSOR  TO  HANDLE  SAME  TASK 

The  cost  of  developing  software  rises  nonlinearly  as  a function  of  the 
hardware  resources  used  by  the  software.  The  nonlinearity  becomes  most 
pronounced  when  the  software  uses  more  than  50  percent  of  the  hardware 
capacity.  There  are  two  mechanisms  which  cause  this  to  occur: 

1.  Programmers  are  forced  into  unstructured  programming 

in  order  to  obtain  the  last  tiny  percentage  of  efficiency. 

2.  The  unstructured  software,  combined  with  a lack  of 
capacity  to  accommodate  test  routines,  seriously  compli- 
cates the  test  problem. 

Use  of  an  ensemble  of  processors  to  handle  a task  which  would  require  80  per- 
cent of  the  largest  known  uniprocessors  will,  as  shown  in  the  curve,  permit 
each  processor  in  the  ensemble  to  be  economically  programmed. 

Figure  18,  Justification  for  Strong  Positive  Interaction 

between  Processor  Headroom  and  Low/ Predictable 
Software  Costs 


(a)  percent  of  speed  and  memory  used  by  ensemble  of  processor  for  a task 

(b)  percent  of  speed  and  memory  used  by  uniprocessor  to  handle  same  task 


The  productivity  of  a software  project  in  terms  of  lines  of  software  per 
man-day  will  be  the  reciprocal  of  the  curve  for  dollars/line  of  software 
since  labor  rates  make  money  a linear  function  of  time.  The  software  pro- 
ductivity will  be  the  governing  factor  on  speed  of  overall  system  develop- 
ment time  since  software  is  always  the  critical-path  item. 


Figure  19.  Justification  for  Strong  Positive  Interaction 
between  Processor  Headroom  and  Short 
Development  Time 
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NUMBER  OF  0-  AND  V-FUNCTIONS  IN  PARNAS  SPECIFICATION 

OF  THE  PROCESS 

Formal  verification  (or  "proof  of  correctness")  techniques  hold  great  promise 
as  a means  to  gain  a high  degree  of  confidence  in  critical  software.  All 
formal  verification  techniques  involve  the  generation  of  assertions  about 
correct  program  behavior  which  in  turn  yield  theorems  which  must  be  proved 
within  some  axiomatic  systems.  These  theorems  are  proved  using  partially 
or  fully  automated  theorem-proving  systems.  These  systems  are  limited  in 
the  amount  of  complexity  they  can  handle  in  a theorem. 

The  amount  of  complexity  in  a theorem  appears  to  be  a nonlinear  function  of 
the  complexity  and  number  of  interactions  in  the  program  from  which  the 
theorem  was  derived.  Program  or  process  complecity  can  be  charactized  in 
terms  of  the  number  of  functions  in  a Parnas  specification  for  the  process. 


A given  task  performed  by  a large  number  of  simple  processes  may  therefore 
be  formally  verifiable  whereas  the  same  task  performed  by  a single  process 
may  not. 

Figure  20.  Justification  for  Strong  Positive  Interaction 

between  Simple  Processes  and  Formal  Verifiability 
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NUMBER  OF  CHIPS  IN  PROCESSOR 


The  number  of  steps  required  to  locate  a fault  to  the  chip  level  increases 
exponentially  with  the  number  of  chips  in  the  processor  because  the  number 
of  processor  states  which  must  be  considered  increases  exponentially  with  the 
number  of  chips.  This  phenomena  can  be  overcome  by  built-in  facilities  for 
parallel  test;  these  facilities  will  generally  only  be  provided  for  processors 
resident  on  ground-based  platforms. 


Figure  21.  Justification  for  Strong  Positive  Interaction 

between  Small  Processors  and  Fault  Detection 
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NUMBER  OF  CLOSELY  COUPLED  PROCESSES 

Two  processes  are  closely  coupled  when  one  process  can  modify  the  state 
space  of  a second.  This  contrasts  with  loosly  coupled  processes  which  can 
only  send  messages;  the  second  process  then  has  the  option  of  ignoring  a 
message  and  thereby  "protecting"  its  state  space  from  the  first  process. 

A fault  may  be  the  result  of  an  action  by  a single  process,  two  closely 
coupled  processes  working  as  unit,  ate.  This  requires  consideration  of 
a single  process,  pairwise,  triples,  etc.  There  are  therefore: 


tests  which  must  be  made  for  n closely  coupled  processes. 

Loosely  coupled  processes  do  not  present  this  problem  because  they  do  not 
combine  into  units  for  purposes  of  stimulating  a fault.  This  is  because 
they  are  able  to  maintain  separation  of  their  state  spaces.  Faults  can 
then  be  located  by  a process-by-process  search  strategy. 

Figure  22,  Justification  for  Strong  Positive  Interaction  between 
Loosely  Coupled  Processes  and  Fault  Detection 
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NUMBER  OF  PROCESSORS  IN  SYSTEM 


20  40  60  80 

PERCENT  OF  SYSTEM  LOST  WHEN  ONE  PROCESSOR  FAILS 


Proper  design  of  interprocessor  links  can  prevent  processor  failures  from 
propagating  across  links.  The  impact  of  a processor  failure  then  becomes 
inversely  proportional  to  the  number  of  processors  in  the  system. 


Figure  23,  Justification  for  Strong  Positive  Interaction 
between  Redundant  Processors  and  Fault 
Isolation/ Loss  Isolation 


Closely  coupled  processes  are  those  with  intersecting  state  spaces.  A set 
of  closely  coupled  processes  can  be  represented  by  a tree:  process  A is 
closely  coupled  to  B,  B to  C and  D,  etc.  A failure  in  A will  propagate  down 
the  tree,  causing  failures  of  lower-level  processes.  The  total  number  of 
processes  affected  is  a nonlinear  function  of  the  number  of  levels  in  the 
process  tree  below  the  faulting  process. 


Figure  24.  Justification  for  Strong  Positive  Interaction 
between  Loosely  Coupled  Processes  and 
Fault  Isolation/ Loss  Isolation 
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The  degree  of  hardware-software  multiplexing  in  a system  can  be  measured 
by  the  number  of  bindings  which  exist  between  processes  and  individual 
hardware  elements  such  as  memory  banks,  processors,  and  links.  A failure 
in  any  hardware  element  will  propagate  to  the  processes  along  these  bindings. 
Thus  if  a memory  bank  is  bound  to  (shared  by)  three  processes,  failure  of 
that  bank  will  cause  all  three  processes  to  fail.  This  is  shown  in  the 


highly  multiplexed  systems  use  processes  to  allocate  and  manage  hardware 
elements.  A failure  of  element  A may  then  propagate  to  process  p,  which 
manages  B.  Failure  of  p is  the  same  as  the  failure  of  B since  B cannot  be 

used  or  allocated  to  any  other  process. 

Figure  25.  Justification  for  Strong  Positive  Interaction 
between  Homomorphism  and  Fault  Isolation 
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PROBABILITY  OF  PROCESSOR  FAILURE 


The  above  table  gives  the  probability  of  processor  failure  as  a function 
of  the  number  and  reliability  of  its  components.  The  striking  relation- 
ship is  the  one  between  the  probability  of  failure  and  the  number  of 
components . 


Figure  26 


Justification  for  Strong  Positive  Correlation 
between  Small  Processors  and  Processor  Reliability 


technologies:  sensor,  platform,  kill,  communications,  and  data  process- 
ing, A full  set  of  linkages  would  show  these  technologies  interacting 
with  themselves  and  each  other  and  would  thereby  make  all  the  implica- 
tions of  all  the  technology  options  visible  to  the  planner.  This  is 
another  aspect  of  a point  which  we  have  made  previously:  that  the 
definition  and  understanding  of  payoffs  becomes  exact  and  complete  only 
in  the  context  of  a BMD  construct.  We  shall  return  to  this  point  when  we 
discuss  the  ways  that  quantifiable  payoffs  might  be  achieved. 

Comparison  of  CDP  and  DPP 

Even  at  this  beginning  stage,  there  exists  enough  information  in  the  Ends/ 
Means  Matrix  to  draw  some  basic  conclusions  about  the  relative  applicability 
of  CDP  and  DDP  to  the  BMD  problem: 

• DDP  provides  a richer  set  of  characteristics  than  CDP, 

There  are  more  means  available  to  achieve  a given  set  of 
ends  through  use  of  interconnected  smaller  processors 
than  through  single  large  ones.  Some  of  these  means,  such 
as  those  associated  with  raw  computational  power,  are 
provided  by  both  CDP  and  DDP;  others,  such  as  the  ability 
to  disperse  processing,  are  unique  to  DDP, 

• The  means  which  DDP  provides  support  the  ends  which  a BMD 
system  must  achieve.  This  support  comes  in  two  broad  areas: 
the  application  of  decentralization  and  dispersion  to  a system 
which  must  deal  with  a hostile  environment,  and  the  application 
of  a building -block  approach  to  complex  and  evolving  systems. 
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SECTION  5 


TOWARD  QUANTIFIABLE  PAYOFFS 


OVERVIEW 


i 

We  stated  at  the  beginning  of  this  report  that  we  would  not  be  able  to  ! 

i 

present  quantifiable  payoffs  at  this  time.  We  considered  the  problem  of  \ 

quantifiable  payoffs  in  significant  depth  before  we  reached  that  conclusion.  i 

Most  of  our  consideration  of  the  problem  took  the  form  of  devising  ways  \ 

to  reach  the  goal  of  quantifiable  payoffs.  Our  results  and  conclusions  | 

in  this  area  are  only  indirectly  concerned  with  the  goal  of  comparing  CDP  | 

and  DDP  for  BMD;  however,  we  believe  that  they  are  interesting  and  j 

important, 

FEASIBILITY  OF  QUANTIFYING  PAYOFFS 

Classes  of  Payoff  Measures 

Warfield  [320]  lists  three  categories  of  objectives /benefits  (payoffs)  and 
ways  in  which  their  achievement  may  be  measured.  In  order  of  decreasing 
rigor,  they  are: 


• Quantifiable  - -measured  by  deterministic  or  probabilistic 
techniques.  ' Deterministic  techniques  compute  values  from 
formulae;  probabilistic  techniques  involve  the  taking  of 
samples  and  interpolating  or  extrapolating  by  means  of  classic 
estimation  methods. 

I 
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• Binary-Event — measured  by  logical  techniques.  A binary-event 
payoff  is  one  which  is  defined  in  terms  of  the  desired  response 
to  a defined  stimulus.  It  is  called  binary-event  because  the 
stated  response  (event)  either  occurs  or  does  not.  Logical 
techniques  therefore  resemble  checkout  or  debugging  methods. 

• Qualitative --measured  by  axiological  techniques.  A 
qualitative  payoff  is  one  whose  measurement  involves  a value 
judgement. 

Measures  During  Phase  2 

At  this  point  in  time  (Project  Planning),  all  payoffs  are  at  best 
qualitative  and  many  are  not  defined  in  any  satisfactory  way  at  all.  This 
is  a direct  consequence  of  the  absence  of  "systems  context"  - -specifics 
about  the  BMD  construct  which  could  be  used  in  formulae  or  binary-event 
descriptions.  Thus  at  this  phase  we  can  state  the  existence  of  a payoff 
called  Reconfigurability;  we  can  place  it  in  the  context  of  the  payoff 
hierarchy  and  show  how  it  contributes  to  higher -level  payoffs.  However, 
we  cannot  state  what  exactly  is  being  reconfigured,  where  reconfiguration 
should  occur,  or  what  event  constitutes  a satisfactory  demonstration  of 
reconfiguration. 

Measures  During  Phase  6 

During  Phase  6 (Operations) , all  payoffs  are  either  quantifiable  or  binary 
event.  This  is  a direct  result  of  the  existence  of  a complete  systems 
context  (in  the  form  of  an  operational  system)  in  which  payoffs  can  be 
defined,  described,  and  measured.  Quantifiable  payoffs  can  be  computed 
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by  means  of  formulae  which  use  the  measured  behavior  of  the  elements  of 
the  system,  and  binary -event  payoffs  can  be  measured  by  tests  using  the 
system  or  simulations  whose  correspondence  to  the  actual  system  can  be 
verified.  Thus  there  exists  one  activity  during  which  payoffs  are 
q uantifiable. 

THE  EVOLUTION  OF  PAYOFFS 
Movement  from  Qualitative  to  Quantifiable 


The  two  states  of  the  payoff  hierarchy  discussed  in  the  above  paragraphs 
can  be  viewed  as  the  beginning  and  end  of  an  evaluaticxi  of  the  payoff 
hierarchy.  The  essence  of  this  evolution  is  the  transformation  of  the 
payoffs  from  qualitative  to  quantifiable  (or  binary-event). 

Thresholds  in  the  Evolution 


Within  this  movement  there  are  three  major  thresholds  which  a specific 
payoff  crosses  as  it  becomes  progressively  better  defined.  They  are: 

• The  Definitional  Threshold--At  this  threshold  a reasonable 
informal  definition  of  the  payoff  is  available  and  intuitive 
curves  can  be  drawn  showing  the  relationship  between  it  and 
its  contributing  payoffs  or,  if  it  is  a bottom -level  payoff, 
what  its  definition  would  be  in  terms  of  proposed  system 
elements  (processors,  links,  etc.). 


.■i 


I 

( ■ 


I 


1 

j 

] 

1 
I 

.] 

• The  Simulation  Threshold- -Here  it  is  possible  to  develop  a 1 

definition  of  the  payoff  in  terms  of  the  behavior  of  a model 

of  the  proposed  system.  The  correlation  between  the 
model  and  reality  will  be  more  or  less  suspect  at  this  time, 

• The  Verification  Threshold --The  final  threshold  is  crossed 
when  enough  detailed  system  context  and  real  system 
elements  are  available  to  verify  the  correctness  of  models 
used  to  demonstrate  or  compute  payoffs  or  to  demonstrate 
or  compute  payoffs  through  actual  test. 

Means  of  Achieving  the  Evolution 

We  believe  that  the  above  discussion  makes  it  clear  that  the  payoff 

hierarchy  evolves  as  the  system  evolves:  the  more  that  is  known  about 

the  system,  the  more  that  is  known  about  the  payoffs.  We  have  identified 

two  ways  in  which  the  necessary  detailed  system  knowledge  can  be  ' 

obtained.  One  way  is  as  a natural  b3rproduct  of  the  development  of  the 

system.  The  other  way  involves  a specific  exercise  separate  from  system 

development.  Both  ways  are  described  in  succeeding  subsections. 

NATURAL  PAYOFF  EVOLUTION 

Overview 


In  this  subsection  we  will  present  an  approach  to  the  evolution  of  payoffs 
from  qualitative  to  quantifiable /binary  event.  The  approach  is  called  the 
"natural”  evolution  because  it  occurs  as  an  integi'al  part  of  the  overall 
system  development.  Its  description  is  straightforward  because  of  Hall's 
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basic  insight  in  developing  the  Activity  Matrix:  that  the  steps  may  be 
repeated  iteratively  through  the  phases.  The  natural  approach  then  consists 
of  repeating  the  Value  System  Design  step  at  each  phase.  The  activities 
which  thereby  result  ((1,  2),  (2,  2),  (3,  2),  etc.)  will  each  involve  a refine- 
ment of  the  payoff  hierarchy,  using  the  systems  context  which  has  been 
developed  during  the  previous  phase.  The  resulting  linkages  are  shown  in 
Figure  27, 

Thresholds 


We  have  also  identified  the  various  activities  during  which  the  major 
thresholds  of  payoff  definition  should  be  crossed.  These  are: 

• The  Definitional  Threshold --This  should  be  crossed  during 
Activity  (2,  2),  Value  System  Design  for  Project  Planning, 
This,  it  should  be  noted,  is  the  activity  in  which  we  placed 
the  task  of  this  heport.  We  also  acknowledge  that  we  had 
not  crossed  the  definitional  threshold  in  our  results.  This 
is  a consequence  of  the  missing  linkage  from  Activities  (1, 1) 
and  (2, 1)  and  the  desire  that  the  results  of  this  contract  be 
independent  of  any  specific  BIWD  construct.  The  latter 
constraint  reduced  the  amount  of  systems  context  below  that 
necessary  to  cross  this  threshold. 

• The  Simulation  Threshold- -This  should  be  crossed  during 
Activity  (3,  2),  Value  System  Design  for  System  Development. 
This  properly  provides  simulation  results  and  payoff  values 
prior  to  heavy  investment  in  construction.  It  is  also  the  first 
activity  in  which  meaningful  models  can  be  built. 
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• The  Verification  Threshold- -This  can  only  be  crossed  during 
Activity  (4,  2),  Value  System  Design  for  Construction,  at 
which  time  a complete  and  detailed  systems  context  will  be 
available  to  verify  models  and  use  in  tests. 

We  also  note  that  the  linkages  shown  in  Figure  27  require  that  activities 
occur  in  an  order  which  is  different  from  that  implied  by  their  numbers  in 
the  Hall  Activity  Matrix.  All  Step  2 activities  (Value  System  Design) 
must  take  place  between  Step  5 (Optimize  Alternatives)  and  Step  6 (Decision 
Making)  in  order  that  the  systems  context  which  resulted  from  a phase  is 
used.  This  is  not  an  exception  to  Hall's  morphology  since,  as  we 
mentioned  earlier,  the  morphology  imposes  only  a partial  ordering  on  the 
activities. 

Advantages 

The  principal  advantages  of  the  natural  evolution  are  economy  and 
accuracy.  Payoffs  are  defined  and  evolved  into  quantifiable  (or  binary - 
event)  form  by  the  use  of  information  which  is  developed  by  other  activities, 
such  as  the  Systems  Synthesis  steps.  The  only  payoff  definitions  which  are 
considered  are  those  which  are  directly  relevant  to  the  system  under 
development.  Each  stage  in  the  evolution  of  the  payoff  definitions 
incorporates  the  most  specific  information  available. 
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Disadvantages 


The  natural  evolution  suffers  from  one  major  disadvantage;  that  an 
adequately  defined  set  of  payoffs  is  not  available  until  after  committment 
to  a specific  system  approach  of  HMD  construct.  This  disadvantage  stems 
from  the  relatively  late  activity  (3,  2)  during  which  the  simulation  threshold 
is  crossed.  As  a result,  the  natural  evolution  cannot  be  used  to  derive  a 
payoff  hierarchy  which  will  be  useful  during  Phases  1 and  2,  when  BMD 
constructs  are  being  selected  and  evaluated.  This  disadvantage  was  the 
motivation  for  developing  the  forced  evolution  approach  which  we  describe 
next. 

FORCED  PAYOFF  EVOLUTION 

Overview 

The  forced  payoff  evolution  takes  place  as  a specific  exercise  within 
Activity  (1,  2),  Value  System  Design  for  Program  Planning.  It  is  intended 
to  take  the  evolution  of  payoff  definitions  as  far  as  possible.  This  end 
point  will  be  just  on  the  other  side  of  the  simulation  threshold  since  to  go 
any  further  requires  actual  system  elements.  The  approach  is  based  on 
an  observation  which  we  have  made  several  times;  that  refined  definitions 
of  payoffs  require  systems  context,  detailed  knowledge  of  specific  system 
characteristics.  The  approach  begins  with  a preliminary  payoff  hierarchy. 
It  then  defines,  in  an  orderly  fashion,  a set  of  generic  BMD  constructs. 

Each  generic  construct  is  developed  to  a level  of  detail  which  permits 
modelling  and  simulation.  The  systems  context  thereby  achieved  is  then 

to  produce  refined  BMD  payoff  hierarchies  on  a per-generic  construct 
iMsia.  This  process  is  illustrated  in  Figure  28, 
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Generic  Constructs 


Development  of  generic  constructs  begins  with  the  decomposition  of  a 
single  successful  kill  into  abstract  functions  (e.g. , detect,  track,  etc.). 
These  abstract  functioi  s,  including  that  of  coordination  of  all  functions,  are 
arranged  into  a functional  structure  which  shows  the  maximum  theoreticad. 
degree  to  which  the  functions  n-  xy  be  performed  in  paradlel.  These 
abstract  functions  are  derived  from  existing  and  proposed  constructs  and 
the  known  ballistic  behavior  of  objects.  The  functions  are  converted  into 
abstract  elements  of  potential  constructs  by  combinational  assignment  of 
platform  types  and  object  path  phases.  The  result  is  a complete  set  of 
abstract  elements  which  could  be  used  as  part  of  the  defense  against  a 
single  object.  An  example  of  such  an  element  would  be  " Track  Boost 

I Phase  Objects  from  Stable  Exoatmospheric  Platform.  " 

i 

1 

1 

j The  set  of  abstract  elements  is  then  refined  and  moved  closer  to  reality 

• by  incorporating  feasible  combinations  of  known  and  foreseen  sensor, 

'■  ' platform,  and  kill  capabilities.  The  capabilities  will  be  derived  from 

technology  survey,  and  feasibility  will  be  derived  from  standard  engineering 
p consideration  of  size,  weight,  power,  etc.  The  result  will  be  a large  set 

of  disjoint  real  elements  such  as  "Track  Boost  Phase  Object  Using  SWIR 
Sensor  on  Synchronous  Satellite. " Each  of  these  elements  is  then  a 
feasible  building  block  for  a potential  BMD  construct. 

Individual  building  blocks  are  combined  into  feasible  sequences  for  success- 
ful kill  of  a single  object.  The  result  is  a single-object  "slice"  of  a 
potential  BMD  construct.  Feasibility  is  established  by  consideration  of 
physical  constraints,  timing,  and  known  and  foreseen  communications 
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capabilities.  Feasible  "slices"  are  then  replicated  auid/or  combined  to 
produce  constructs.  The  ability  of  platforms  to  have  multiple  functions 
is  taken  into  account  at  this  step,  along  with  the  ability  of  certain  platform/ 
sensor  combinations  to  perform  functions  for  multiple  objects. 

A model  is  developed  for  each  generic  construct.  This  insures  the 
completeness  of  the  construct  and  permits  exercise  against  various  threat 
models.  Once  this  is  done,  a BMD  payoff  hierarchy  is  produced  for  each 
generic  construct.  Each  hierarchy  will  contain  payoffs  whose  definitions 
are  given  in  quantitative  and  binary-event  terms  using  the  elements  of  the 
generic  construct. 

Advantages 

The  principal  advantage  of  the  forced  evoluticn  is  that  it  provides  a 
maximum  amount  of  information  about  potential  BMD  constructs  for  later 
activities  as  well  as  evolving  a highly  refined  payoff  hierarchy  during  the 
Program  Planning  Phase.  Both  the  payoff  hierarchy  and  the  descriptions 
of  the  potential  BMD  constructs  will  therefore  be  available  to  support 
critical  technical  decision  at  the  time  that  they  are  made. 

Disadvantages 

These  advantages  are  offset  by  the  cost  of  such  an  effort  and  the  risk  that 
certain  feasible  system  elements  will  be  overlooked  or  misrepresented  in 
the  generic  constructs.  This  is  an  unavoidable  price  for  early  information. 
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SECTION  6 


SUMMARY  AND  CONCLUSION 


SUMMARY 

In  summary,  then,  we  have  taken  the  informal  and  intuitive  concept  of 
BMD  payoffs  and  refined  it  by  defining  a preliminary  set  of  payoffs  and 
organizing  the  payoffs  into  a hierarchical  structure.  We  have  placed  the 
BMD  payoff  effort  in  the  context  of  mainstream  Systems  Engineering 
thought  and  indicated  that  the  desired  payoff  hierarchy  can  be  produced 
using  the  proven  technique  of  Interpretive  Structural  Modelling.  We 
showed  how  the  resultant  hierarchy  can  be  used  to  compare  broad 
technological  alternatives,  developed  a hierarchy,  and  compared  the 
alternatives  of  centralized  and  distributed  data  processing.  We  showed  the 
close  relationship  that  exists  between  the  amount  of  detailed  knowledge  of 
a system  being  evaluated  by  payoffs  and  the  refinement  and  vigor  of  the 
payoff  definitions  themselves.  We  finished  our  effort  with  two  approaches 
which  would  achieve  the  desirable  goal  of  quantifiable  payoffs. 

CONCLUSIONS 

As  a result  of  these  efforts,  we  have  drawn  the  following  conclusions; 

• Quantification  of  payoffs  is  not  feasible  at  this  time. 

• The  Hall-Hill-Warfield  schema  provides  a means  for  comparing 
CDP  and  DDP  without  quantification. 
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• The  Hall-Hill-Warfield  schema  also  provides  a useful  framework 
in  which  to  discuss  various  aspects  of  the  BMD  problem. 

• The  comparison  of  CDP  and  DDP  which  we  performed,  although 
not  quantitative,  showed  that  DDP  was  a better  match  to  the 
BMD  problem  than  CDP. 

• The  nonquantitative  comparison  showed  that  there  is  a 
definite  need  for  quantified  payoffs. 

• There  exist  at  least  two  approaches  which  will  yield 
quantifiable  payoffs. 


SECTION  7 


FURTHER  RESEARCH 


OVERVIEW 

We  begin  this  discussion  by  noting  that  our  adaptation  of  the  Hall-Hill- 
Warfield  schema  for  Systems  Engineering  was  done  as  a means  toward  the 
end  of  a comparison  of  CDP  and  DDP,  We  therefore  only  treated  those 
aspects  of  the  schema  which  directly  contributed  toward  that  end.  We  did, 
however,  survey  the  whole  field,  and  we  are  convinced  that  it  contains 
many  elements  of  potential  benefit  to  BMD,  We  believe  that  these 
benefits  could  be  realized  by  research  in  the  following  areas: 

• Adaptation  of  the  schema  to  BMD, 

• Development  of  a preliminary  BMD  payoff  hierarchy,  and 

• Forced  evolution  to  quantifiable  payoffs. 

Each  of  these  areas  will  be  discussed  in  the  next  subsection. 

RESEARCH  AREAS 

Adaptation  of  the  Schema 

Development  and  refinement  of  the  Hall -Hill -Warfield  schema  has  taken 
place  in  the  context  of  urban  and  societal  systems.  This  is  reflected  in 
the  vertical  dimension  of  the  Hall  morphology  (Figure  1)  which  is  indexed 
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using  discplines  far  removed  from  the  engineering  concerns  of  BMD,  The 
general  aspects  of  the  schema  should  be  preserved,  new  phases,  steps,  and 
disciplines  should  be  defined,  and  relevant  linkages  should  be  specified. 

The  resulting  schema  would  provide  a single  context  and  standard  set  of 
terms  for  all  method-related  research  in  BMD.  This  in  turn  would  provide 
the  following  advantages: 

• Research  plans  and  results  would  use  a standard  set  of  terms 
to  describe  the  activities  which  were  being  performed  or 
investigated.  This  would  provide  the  ability  to  effectively 
compare  plans  and  results  and  would  show  the  context  of 
research  in  a known  format. 


Development  of  a linkage  diagram  for  research  efforts  in  a 
standard  format  would  increase  the  chances  of  detecting 
incomplete  efforts  - -those  which  depend  on  activities  that 
have  not  been  performed.  Such  a linkage  diagram  would 
prevent  occurrences  such  as  the  missing  linkage  which 
plagued  our  effort. 


Payoff  Development 


The  need  for  a BMD  value  system  is  obvious.  The  rapid  development  of 
technology  in  the  areas  of  sensors,  data  processing,  and  platforms  has 
produced  a combinatorial  explosion  of  technological  alternatives  whose 
evaluation  is  extremely  difficult.  Any  decision  to  develop  and  deploy  a 
specific  BMD  system  would  involve  a major  commitment  of  national 
resources  and  must  be  guided  by  a detailed  set  of  meaningful  objectives. 
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These  objectives  are,  in  Hall's  terminology,  the  value  system  and,  in  our 
terminology,  the  payoffs.  The  adaptation  of  the  schema  will  specify  the 
interrelationship  between  the  value  system  and  the  various  activities  which 
comprise  development  and  deployment;  the  payoff  development  will 
generate  a specific  set  of  payoffs  which  will  drive  interrelationships.  This 
payoff  development  activity  should  comprise  a full-scade  ISM  exercise. 

Our  experience  with  ISM  indicates  that  a 20  x 20  binary  matrix  is  the 
largest  that  can  be  reasonably  converted  into  a hierarchy  by  manual  methods. 
Even  then,  the  effort  involved  is  a serious  inhibiting  factor  to  an  iterative 
or  trial-and-evaluation  approach  to  hierarchy  development,  A number  of 
automatable  algorithms  for  binary  matrix  manipulation  have  been  specified 
by  Warfield  [315,  316,  317,  318],  and  these  should  be  implemented  in 
order  to  support  the  use  of  ISM  in  payoff  development. 

The  results  of  this  research  will  be  a preliminary  set  of  BMD  payoffs 
organized  into  a hierarchy.  The  vast  bulk  of  these  payoffs  will  be 
qualitative.  This  exercise  will  carry  the  BMD  payoff  hierarchy  across  the 
definitional  threshold  and  will  confer  the  following  advantages: 

• A complete  description  of  BMD  policy  will  be  available  in 
technologically  relevant  terms  as  a guide  to  evaluating 
technology  and  establishing  research  directions. 

• A structured  definition  of  BMD  policy  will  be  available  to 
provide  insight  into  the  BMD  problem  for  interested  parties 
outside  the  BMD  community. 
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Forced  Evolution 

The  payoff  hierarchy  which  results  from  the  above  effort  can  then  be  used 
as  input  to  a full-scale  exercise  of  Activity  (1,  3),  Systems  Synthesis  for 
Program  Planning.  This  activity  should  proceed  in  the  following  steps: 

• The  forced  evolution  method  which  was  described  above  should 
be  refined  and  planned  in  greater  detail.  A specific  set  of 
functions  should  be  derived,  and  sources  of  the  known  and 
foreseen  sensor,  platform,  kill,  and  communication  capability 
should  be  identified. 

• The  refined  method  should  be  used  to  generate  a set  of  generic 
constructs.  These  constructs  should  be  produced  in  order 

of  increasing  risk;  that  is.  the  first  ones  should  use  the 
maximum  amount  of  known  or  "in-hand"  technology. 

• The  most  reasonable  and  the  most  promising  of  these  generic 
constructs  should  be  modelled  to  the  level  of  detail  that 
permits  quantifiable  or  binary-event  definitions  of  payoffs. 

• A payoff  hierarchy  should  be  refined  for  each  construct, 
using  the  primitives  defined  for  their  models. 

The  result  will  be  a set  of  payoff  hierarchies  which  permit  comparison  of 
detailed  data  processing  technological  alternatives.  These  comparisons 
will  be  quantifiable  (or  binary  event)  and  will  be  relevant  because  they  will 
take  place  in  the  context  of  a set  of  sensor,  platform,  kill,  and  communica- 
tion capabilities.  The  data  processing  planning  and  research  will 
therefore  have  available  to  it  a real  set  of  objectives --not  "real"  in  the 


sense  of  attainable  but  "real"  in  the  sense  that  the  objectives  are  stated 
in  the  terms  of  the  objects  which  the  data  processing  subsystem  must 
manage. 

It  is  also  possible  that  the  set  of  payoff  hierarchies  could  be  used  to 
compare  generic  constructs  as  well  as  to  compare  alternatives  within  a 
construct.  The  payoff  hierarchy  for  each  generic  construct  has  the  same 
payoffs  arranged  in  the  same  structure.  The  difference  is  that  the 
definitions  of  some  of  the  payoffs  are  construct -dependent.  It  is  possible 
that  the  construct -dependent  definitions  can  be  restricted  to  payoffs  that 
reside  at  low  levels  in  the  hierarchy.  If  this  is  the  case,  values  may  be 
computable  for  higher -level  payoffs,  values  which  are  construct - 
independent.  The  values  for  these  higher -level  payoffs  may  then  be  used 
to  compare  generic  constructs. 
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